Using the GitHub login command line streamlines authentication for scripts, CI pipelines, and personal access token management. This approach removes the need to open a browser repeatedly and gives you fine-grained control over scopes and account context.
Below is a quick reference table, followed by in-depth sections on configuring the CLI, managing tokens, and troubleshooting common issues.
| Command | Use Case | Key Flags | Typical Output |
|---|---|---|---|
| gh auth login | Interactive setup for Git credential helper and token storage | --web, --with-token | Authentication success, host set to github.com |
| gh auth login --hostname | Connect to GitHub Enterprise Server instances | --hostname, --web | Host-specific authentication configured |
| gh auth token | Print the currently stored token for scripting | None | Token string or empty if not set |
| gh auth status | Review account, scopes, and Git helper status | --hostname | Login state, account, scopes, Git protocol |
Setting Up GitHub Login Command Line with gh
The GitHub CLI (gh) provides the most straightforward path for command line authentication. Installing gh and running gh auth walk you through browser-based OAuth or token input, and it can configure the Git credential helper automatically.
During setup, you choose the default host, typically github.com, and pick between HTTPS and SSH for Git operations. The command also lets you specify scopes up front so the token matches your intended usage, such as read:org or workflow.
You can paste an existing fine-grained personal access token when prompted, or use --with-token to feed a token from a file or environment variable. This makes scripted onboarding in containers or CI straightforward while keeping interactive steps optional.
Using a Personal Access Token with the Command Line
If you already have a classic personal access token, you can supply it to gh auth login using the --with-token flag. This is useful in automated environments where you cannot rely on browser interaction.
Place the token in a secure location, such as a secrets store, and reference it via an environment variable or a file with strict permissions. The command will set the token for the selected host and mark it as the active authentication method for subsequent gh and Git calls.
Remember to choose the correct scopes when creating the token so that commands like repo, workflow, and read:org align with your automation needs. Over-scoped tokens increase risk, while under-scoped tokens lead to unexpected permission errors during execution.
Managing Multiple Hosts and Fine-Grained Tokens
For teams using GitHub Enterprise Server, the --hostname flag lets you authenticate against custom hosts without affecting your github.com session. Each host maintains its own token storage and credential helper configuration.
Fine-grained personal access tokens provide better control with expiration policies and limited scopes. After generating such a token, use gh auth login with the token value to bind it to a specific host and purpose.
You can switch contexts with gh auth use, specifying both the host and the account. This is helpful when you maintain integrations for multiple organizations or need to toggle between different permission sets.
Troubleshooting Common Authentication Issues
Authentication failures often stem from expired tokens, mismatched scopes, or misconfigured Git helpers. Running gh auth status shows the current token, scopes, and whether the Git protocol is set to HTTPS or SSH.
Token rejection from the server may require re-authentication via gh auth login or replacing the token with a newly generated one. For SSH-based workflows, verify that your public key is added to the GitHub account or enterprise instance.
Permission errors during API calls or Git pushes should prompt a check of both repository-specific access and the minimal scope required for your scripts. Tightening permissions reduces noise and improves security posture across the board.
Best Practices for Command Line Authentication
- Prefer fine-grained tokens with minimal scopes required for your workflows.
- Store tokens in secrets managers or environment variables, never in plain scripts or history.
- Use gh auth status regularly to verify host, scopes, and Git protocol settings.
- Rotate tokens periodically and update automated workflows promptly.
- Leverage gh auth use when working with multiple hosts or accounts.
FAQ
Reader questions
How do I authenticate non-interactively in a Docker container using the GitHub login command line?
Set the GH_TOKEN environment variable or pass --with-token with a file containing a fine-grained personal access token, then run gh auth login to store the credentials securely for subsequent gh and Git operations.
What should I do if gh auth status shows no valid token?
Run gh auth login again, either interactively or with --with-token, and make sure the token has the necessary scopes for the actions you intend to perform, such as repo or workflow.
Can I use the GitHub CLI with GitHub Enterprise Server?
Yes, use gh auth login --hostname your-enterprise.example.com to authenticate and configure the Git remote to point to the internal server instead of github.com.
How do I switch between multiple GitHub accounts using the command line?
Use gh auth use to select a specific host and account, which updates the Git credential helper and token context for subsequent commands and operations.